topic Re: How search and list the same session ID's occurring in two or more hosts? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/587912#M204746 <P>What if I want to plot it on a graph on timechart like how many sessionIds had more than 1 hosts over a specific period of time</P> Mon, 07 Mar 2022 21:51:14 GMT ermanoj21yadav 2022-03-07T21:51:14Z How search and list the same session ID's occurring in two or more hosts? https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/234140#M69571 <P>Hi </P> <P>I have fields created for both sessionId and host. Now I wanna find out the same sessionId happening in two different hosts and list them:</P> <P>search: <CODE>index="atg" sessionId="*mob" host="*"</CODE></P> <P>sessionId example =16E4E8BA9480F388B11B3FC35B07732E.svcldprdapp06b-33mob</P> Wed, 23 Sep 2015 15:22:25 GMT https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/234140#M69571 pavanae 2015-09-23T15:22:25Z Re: How search and list the same session ID's occurring in two or more hosts? https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/234141#M69572 <P>Try something like this</P> <PRE><CODE>index="atg" sessionId="*mob" host="*" | stats dc(host) as hostCount values(host) as hosts by sessionId | where hostCount&gt;=2 </CODE></PRE> Wed, 23 Sep 2015 20:12:12 GMT https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/234141#M69572 somesoni2 2015-09-23T20:12:12Z Re: How search and list the same session ID's occurring in two or more hosts? https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/234142#M69573 <P>Thanks worked great</P> Fri, 25 Sep 2015 15:51:06 GMT https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/234142#M69573 pavanae 2015-09-25T15:51:06Z Re: How search and list the same session ID's occurring in two or more hosts? https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/587912#M204746 <P>What if I want to plot it on a graph on timechart like how many sessionIds had more than 1 hosts over a specific period of time</P> Mon, 07 Mar 2022 21:51:14 GMT https://community.splunk.com/t5/Splunk-Search/How-search-and-list-the-same-session-ID-s-occurring-in-two-or/m-p/587912#M204746 ermanoj21yadav 2022-03-07T21:51:14Z